111

2026-09-21 17:52:21 +08:00 · 2026-09-21 17:52:21 +08:00 · f156204e1e
commit f156204e1e
parent e7227e0df0
7 changed files with 110 additions and 57 deletions
--- a/.gitea/workflows/sync-consul.yml
+++ b/.gitea/workflows/sync-consul.yml
@ -38,7 +38,9 @@ jobs:
            ls -la /etc/rancher/k3s/ /root/.kube/ 2>/dev/null || true
            exit 1
          fi
-          export RESTART_APIS=1
+          # 暂时关闭改配置后自动重启 API
+          # export RESTART_APIS=1
+          export RESTART_APIS=0

          REPO="${{ gitea.repository }}"
          SHA="${{ gitea.sha }}"
--- a/README.md
+++ b/README.md
@ -89,13 +89,20 @@ Consul **不要**走公网 Ingress；集群内业务仍用 `consul.test.svc:8500

 ## 密钥来源

-| 占位符 | Secret（在目标 NAMESPACE 内） |
-|--------|------------------------------|
-| `${MYSQL_ROOT_PASSWORD}` | `prod-credentials` |
-| `${REDIS_PASSWORD}` | `prod-credentials` |
-| `${RABBITMQ_DEFAULT_PASS}` | `prod-credentials` |
-| `${ELASTIC_PASSWORD}` | `prod-credentials` |
-| `${JWT_SECRET_KEY}` | `jwt-secret` 或 `prod-credentials` |
+| 占位符 | Secret（在目标 NAMESPACE 内 `prod-credentials`） |
+|--------|--------------------------------------------------|
+| `${MYSQL_ROOT_PASSWORD}` | MYSQL_ROOT_PASSWORD |
+| `${REDIS_PASSWORD}` | REDIS_PASSWORD |
+| `${RABBITMQ_DEFAULT_PASS}` | RABBITMQ_DEFAULT_PASS |
+| `${ELASTIC_PASSWORD}` | ELASTIC_PASSWORD |
+| `${JWT_SECRET_KEY}` | JWT_SECRET_KEY（或单独 `jwt-secret`） |
+| `${COS_SECRET_ID}` / `${COS_SECRET_KEY}` | COS_* |
+| `${FEISHU_WEBHOOK}` | FEISHU_WEBHOOK |
+| `${WECHAT_MP_*}` | WECHAT_MP_APP_ID / SECRET / TOKEN |
+| `${OMS_TRACK_*}` | OMS_TRACK_APP_KEY / SECRET |
+| `${LAZADA_*}` `${SHOPEE_*}` `${TIKTOK_*}` `${TEMU_*}` | 对应平台密钥 |
+
+同步后 **默认不再** `rollout restart`（已暂时关闭）；需要时手动 restart 或恢复脚本里注释块。

 ## 注意

--- a/idwms/admin.json
+++ b/idwms/admin.json
@ -2,16 +2,19 @@
  "App": {
    "Urls": [
      "http://*:5281"
+    ],
+    "CorsOrigins": [
+      "https://app.test.ideship.com"
    ]
  },
  "AllowedHosts": "*",
  "ConnectionStrings": {
-    "Default": "server=mysql.test.svc.cluster.local;database=fake_simple_admin;uid=dev;pwd=itd!@#123;charset=utf8mb4;",
-    "Rbac": "server=mysql.test.svc.cluster.local;database=fake_simple_admin;uid=dev;pwd=itd!@#123;charset=utf8mb4;"
+    "Default": "server=mysql.test.svc.cluster.local;database=fake_simple_admin;uid=dev;pwd=${MYSQL_ROOT_PASSWORD};charset=utf8mb4;",
+    "Rbac": "server=mysql.test.svc.cluster.local;database=fake_simple_admin;uid=dev;pwd=${MYSQL_ROOT_PASSWORD};charset=utf8mb4;"
  },
  "Redis": {
    "Host": "redis.test.svc.cluster.local:6379",
-    "Password": "itd!@#123",
+    "Password": "${REDIS_PASSWORD}",
    "MaxPoolSize": 1000,
    "Database": 0,
    "Prefix": ""
@ -22,7 +25,7 @@
        "HostName": "rabbitmq.test.svc.cluster.local",
        "Port": 5672,
        "UserName": "rabbit",
-        "Password": "itd!@#123",
+        "Password": "${RABBITMQ_DEFAULT_PASS}",
        "DispatchConsumersAsync": true
      }
    },
@ -39,9 +42,9 @@
  },
  "WeChat": {
    "Mp": {
-      "AppId": "wxd5141ba46c856e1f",
-      "Secret": "379f51a89419dc36fbb9167feef6f89a",
-      "Token": "c6ca74013df823c0e1da0feaaaf8bf66",
+      "AppId": "${WECHAT_MP_APP_ID}",
+      "Secret": "${WECHAT_MP_SECRET}",
+      "Token": "${WECHAT_MP_TOKEN}",
      "EncodingAesKey": "",
      "OAuthRedirectBase": "https://app.test.ideship.com"
    }
@ -55,8 +58,8 @@
    "TrackService": {
      "Enabled": true,
      "BaseUrl": "https://api.test.ideship.com/track",
-      "AppKey": "W2606001",
-      "AppSecret": "ziK8UzlQ39m3kdL346XEBg8nljY8os52",
+      "AppKey": "${OMS_TRACK_APP_KEY}",
+      "AppSecret": "${OMS_TRACK_APP_SECRET}",
      "TimeoutSeconds": 30
    },
    "Itfx": {
@ -66,26 +69,26 @@
    "PlatformShop": {
      "FrontendBaseUrl": "https://app.test.ideship.com",
      "Lazada": {
-        "AppKey": "123631",
-        "AppSecret": "7vBz2EaD6rIupeGEfwrgkabsTNsXt2ix",
+        "AppKey": "${LAZADA_APP_KEY}",
+        "AppSecret": "${LAZADA_APP_SECRET}",
        "AuthorizeUrl": "https://auth.lazada.com/oauth/authorize",
        "AccessTokenUrl": "https://auth.lazada.com/rest"
      },
      "Shopee": {
-        "PartnerId": 2004112,
-        "PartnerKey": "2f385d7ea38b087d5d71f7292e06a09c9f19022ca6c3f60ec0110a8214ef7d65",
+        "PartnerId": ${SHOPEE_PARTNER_ID},
+        "PartnerKey": "${SHOPEE_PARTNER_KEY}",
        "HostUrl": "https://openplatform.shopee.cn",
        "HostAuthUrl": "https://partner.shopeemobile.com"
      },
      "Tiktok": {
-        "AppKey": "6hc64lc6vl312",
-        "AppSecret": "5a691a96ee6d844534769bab5c21de1f848fb678",
+        "AppKey": "${TIKTOK_APP_KEY}",
+        "AppSecret": "${TIKTOK_APP_SECRET}",
        "HostAuth": "https://auth.tiktok-shops.com",
        "HostApi": "https://open-api.tiktokglobalshop.com"
      },
      "Temu": {
-        "AppKey": "4ebbc9190ae410443d65b4c2faca981f",
-        "AppSecret": "4782d2d827276688bf4758bed55dbdd4bbe79a79",
+        "AppKey": "${TEMU_APP_KEY}",
+        "AppSecret": "${TEMU_APP_SECRET}",
        "HostAuthUrl": "https://openapi-b-us.temu.com/openapi/router"
      }
    }
--- a/idwms/common.json
+++ b/idwms/common.json
@ -1,7 +1,7 @@
 {
  "App": {
    "CorsOrigins": [
-      "https://test.ideship.com"
+      "https://app.test.ideship.com"
    ]
  },
  "Serilog": {
@ -42,7 +42,7 @@
    ]
  },
  "FeiShuNotice": {
-    "Webhook": "https://open.feishu.cn/open-apis/bot/v2/hook/94e24bce-619d-4b3b-936c-e206353ce802",
+    "Webhook": "${FEISHU_WEBHOOK}",
    "BatchSize": 10,
    "BatchIntervalSeconds": 10,
    "EnableFeiShuExceptionSubscribe": true,
@ -52,7 +52,7 @@
    "MaxLength": 3000
  },
  "JwtSettings": {
-    "SecretKey": "YourSuperSecretKeyThatIsAtLeast32CharactersLong!",
+    "SecretKey": "${JWT_SECRET_KEY}",
    "Issuer": "SimpleAdmin",
    "Audience": "SimpleAdminClient",
    "ExpiryInMinutes": 600,
@ -61,8 +61,8 @@
  "FileStorage": {
    "Provider": "Cos",
    "Cos": {
-      "SecretId": "AKIDdOxIOGuKVSAetteBTbZLtCG6i5D6k9JE",
-      "SecretKey": "kEWbWDPPAhz2qQq4FF5kBOXTAcpnkY8U",
+      "SecretId": "${COS_SECRET_ID}",
+      "SecretKey": "${COS_SECRET_KEY}",
      "Region": "ap-guangzhou",
      "Bucket": "ideship-1308574410",
      "BaseUrl": "https://cos.ideship.com",
@ -76,8 +76,8 @@
    "SignUrlsByDefault": true,
    "DefaultSignedUrlExpiresSeconds": 900,
    "TencentCos": {
-      "SecretId": "AKIDdOxIOGuKVSAetteBTbZLtCG6i5D6k9JE",
-      "SecretKey": "kEWbWDPPAhz2qQq4FF5kBOXTAcpnkY8U",
+      "SecretId": "${COS_SECRET_ID}",
+      "SecretKey": "${COS_SECRET_KEY}",
      "Region": "ap-guangzhou",
      "Bucket": "ideship-1308574410",
      "BaseUrl": "https://cos.ideship.com",
--- a/idwms/itfxapi.json
+++ b/idwms/itfxapi.json
@ -19,11 +19,11 @@
    "KeyPrefix": "itfx"
  },
  "ConnectionStrings": {
-    "Default": "server=mysql.test.svc.cluster.local;database=interface_forward;uid=dev;pwd=itd!@#123;charset=utf8mb4;"
+    "Default": "server=mysql.test.svc.cluster.local;database=interface_forward;uid=dev;pwd=${MYSQL_ROOT_PASSWORD};charset=utf8mb4;"
  },
  "Redis": {
    "Host": "redis.test.svc.cluster.local:6379",
-    "Password": "itd!@#123",
+    "Password": "${REDIS_PASSWORD}",
    "MaxPoolSize": 1000,
    "Database": 0,
    "Prefix": ""
@ -34,7 +34,7 @@
        "HostName": "rabbitmq.test.svc.cluster.local",
        "Port": 5672,
        "UserName": "rabbit",
-        "Password": "itd!@#123",
+        "Password": "${RABBITMQ_DEFAULT_PASS}",
        "DispatchConsumersAsync": true
      }
    }
@ -42,7 +42,7 @@
  "ElasticSearch": {
    "NodeUrls": [ "http://es.test.svc.cluster.local:9200" ],
    "LoginName": "elastic",
-    "Password": "itd!@#123",
+    "Password": "${ELASTIC_PASSWORD}",
    "ShowLogInfo": false,
    "IndexPrefix": ""
  }
--- a/idwms/trackapi.json
+++ b/idwms/trackapi.json
@ -15,11 +15,11 @@
    "TrackPullTaskMinuteInterval": 5
  },
  "ConnectionStrings": {
-    "Default": "server=mysql.test.svc.cluster.local;database=track_center;uid=dev;pwd=itd!@#123;charset=utf8mb4;"
+    "Default": "server=mysql.test.svc.cluster.local;database=track_center;uid=dev;pwd=${MYSQL_ROOT_PASSWORD};charset=utf8mb4;"
  },
  "Redis": {
    "Host": "redis.test.svc.cluster.local:6379",
-    "Password": "itd!@#123",
+    "Password": "${REDIS_PASSWORD}",
    "MaxPoolSize": 1000,
    "Database": 1,
    "Prefix": ""
@ -30,7 +30,7 @@
        "HostName": "rabbitmq.test.svc.cluster.local",
        "Port": 5672,
        "UserName": "rabbit",
-        "Password": "itd!@#123",
+        "Password": "${RABBITMQ_DEFAULT_PASS}",
        "DispatchConsumersAsync": true
      }
    }
@ -38,7 +38,7 @@
  "ElasticSearch": {
    "NodeUrls": [ "http://es.test.svc.cluster.local:9200" ],
    "LoginName": "elastic",
-    "Password": "itd!@#123",
+    "Password": "${ELASTIC_PASSWORD}",
    "ShowLogInfo": false,
    "IndexPrefix": ""
  },
--- a/scripts/sync-to-consul.sh
+++ b/scripts/sync-to-consul.sh
@ -138,14 +138,45 @@ load_secret REDIS_PASSWORD prod-credentials REDIS_PASSWORD
 load_secret RABBITMQ_DEFAULT_PASS prod-credentials RABBITMQ_DEFAULT_PASS
 load_secret ELASTIC_PASSWORD prod-credentials ELASTIC_PASSWORD
 load_secret JWT_SECRET_KEY jwt-secret JWT_SECRET_KEY
-# 兼容：JWT 也放在 prod-credentials
 load_secret JWT_SECRET_KEY prod-credentials JWT_SECRET_KEY
+load_secret COS_SECRET_ID prod-credentials COS_SECRET_ID
+load_secret COS_SECRET_KEY prod-credentials COS_SECRET_KEY
+load_secret FEISHU_WEBHOOK prod-credentials FEISHU_WEBHOOK
+load_secret WECHAT_MP_APP_ID prod-credentials WECHAT_MP_APP_ID
+load_secret WECHAT_MP_SECRET prod-credentials WECHAT_MP_SECRET
+load_secret WECHAT_MP_TOKEN prod-credentials WECHAT_MP_TOKEN
+load_secret OMS_TRACK_APP_KEY prod-credentials OMS_TRACK_APP_KEY
+load_secret OMS_TRACK_APP_SECRET prod-credentials OMS_TRACK_APP_SECRET
+load_secret LAZADA_APP_KEY prod-credentials LAZADA_APP_KEY
+load_secret LAZADA_APP_SECRET prod-credentials LAZADA_APP_SECRET
+load_secret SHOPEE_PARTNER_ID prod-credentials SHOPEE_PARTNER_ID
+load_secret SHOPEE_PARTNER_KEY prod-credentials SHOPEE_PARTNER_KEY
+load_secret TIKTOK_APP_KEY prod-credentials TIKTOK_APP_KEY
+load_secret TIKTOK_APP_SECRET prod-credentials TIKTOK_APP_SECRET
+load_secret TEMU_APP_KEY prod-credentials TEMU_APP_KEY
+load_secret TEMU_APP_SECRET prod-credentials TEMU_APP_SECRET

 : "${MYSQL_ROOT_PASSWORD:?缺少 MYSQL_ROOT_PASSWORD（env 或 secret/${NS}/prod-credentials）}"
 : "${REDIS_PASSWORD:?缺少 REDIS_PASSWORD}"
 : "${RABBITMQ_DEFAULT_PASS:?缺少 RABBITMQ_DEFAULT_PASS}"
 : "${ELASTIC_PASSWORD:?缺少 ELASTIC_PASSWORD}"
 : "${JWT_SECRET_KEY:?缺少 JWT_SECRET_KEY（请创建 secret/jwt-secret 或写入 prod-credentials）}"
+: "${COS_SECRET_ID:?缺少 COS_SECRET_ID}"
+: "${COS_SECRET_KEY:?缺少 COS_SECRET_KEY}"
+: "${FEISHU_WEBHOOK:?缺少 FEISHU_WEBHOOK}"
+: "${WECHAT_MP_APP_ID:?缺少 WECHAT_MP_APP_ID}"
+: "${WECHAT_MP_SECRET:?缺少 WECHAT_MP_SECRET}"
+: "${WECHAT_MP_TOKEN:?缺少 WECHAT_MP_TOKEN}"
+: "${OMS_TRACK_APP_KEY:?缺少 OMS_TRACK_APP_KEY}"
+: "${OMS_TRACK_APP_SECRET:?缺少 OMS_TRACK_APP_SECRET}"
+: "${LAZADA_APP_KEY:?缺少 LAZADA_APP_KEY}"
+: "${LAZADA_APP_SECRET:?缺少 LAZADA_APP_SECRET}"
+: "${SHOPEE_PARTNER_ID:?缺少 SHOPEE_PARTNER_ID}"
+: "${SHOPEE_PARTNER_KEY:?缺少 SHOPEE_PARTNER_KEY}"
+: "${TIKTOK_APP_KEY:?缺少 TIKTOK_APP_KEY}"
+: "${TIKTOK_APP_SECRET:?缺少 TIKTOK_APP_SECRET}"
+: "${TEMU_APP_KEY:?缺少 TEMU_APP_KEY}"
+: "${TEMU_APP_SECRET:?缺少 TEMU_APP_SECRET}"

 # Consul：prod 用 ClusterIP（runner 在簇内）；test 用内网 NodePort（见 consul-ci / TEST_CONSUL_HTTP_ADDR）
 if [[ -z "$CONSUL_HTTP_ADDR" ]]; then
@ -208,8 +239,15 @@ for name in "${TARGETS[@]}"; do
  [[ -f "$src" ]] || { echo "FAIL: 无 ${src}"; exit 1; }

  # 仅替换已知占位符，避免 JSON 里其它 $ 被误伤
-  export MYSQL_ROOT_PASSWORD REDIS_PASSWORD RABBITMQ_DEFAULT_PASS ELASTIC_PASSWORD JWT_SECRET_KEY
-  envsubst '${MYSQL_ROOT_PASSWORD} ${REDIS_PASSWORD} ${RABBITMQ_DEFAULT_PASS} ${ELASTIC_PASSWORD} ${JWT_SECRET_KEY}' \
+  export MYSQL_ROOT_PASSWORD REDIS_PASSWORD RABBITMQ_DEFAULT_PASS ELASTIC_PASSWORD JWT_SECRET_KEY \
+    COS_SECRET_ID COS_SECRET_KEY FEISHU_WEBHOOK \
+    WECHAT_MP_APP_ID WECHAT_MP_SECRET WECHAT_MP_TOKEN \
+    OMS_TRACK_APP_KEY OMS_TRACK_APP_SECRET \
+    LAZADA_APP_KEY LAZADA_APP_SECRET \
+    SHOPEE_PARTNER_ID SHOPEE_PARTNER_KEY \
+    TIKTOK_APP_KEY TIKTOK_APP_SECRET \
+    TEMU_APP_KEY TEMU_APP_SECRET
+  envsubst '${MYSQL_ROOT_PASSWORD} ${REDIS_PASSWORD} ${RABBITMQ_DEFAULT_PASS} ${ELASTIC_PASSWORD} ${JWT_SECRET_KEY} ${COS_SECRET_ID} ${COS_SECRET_KEY} ${FEISHU_WEBHOOK} ${WECHAT_MP_APP_ID} ${WECHAT_MP_SECRET} ${WECHAT_MP_TOKEN} ${OMS_TRACK_APP_KEY} ${OMS_TRACK_APP_SECRET} ${LAZADA_APP_KEY} ${LAZADA_APP_SECRET} ${SHOPEE_PARTNER_ID} ${SHOPEE_PARTNER_KEY} ${TIKTOK_APP_KEY} ${TIKTOK_APP_SECRET} ${TEMU_APP_KEY} ${TEMU_APP_SECRET}' \
    <"$src" >"${TMP}/${name}.json"

  # 禁止未替换的占位符漏网（注释里的 ${...} 也会拦）
@ -236,19 +274,22 @@ for name in "${TARGETS[@]}"; do
  esac
 done

+# 暂时关闭：改配置后自动 rollout restart API（需要时把下面取消注释，或 CI 设 RESTART_APIS=1）
+# if [[ "$RESTART_APIS" == "1" ]]; then
+#   readarray -t RESTART_SET < <(printf '%s\n' "${RESTART_SET[@]}" | sort -u)
+#   echo "==> rollout restart: ${RESTART_SET[*]}"
+#   for d in "${RESTART_SET[@]}"; do
+#     [[ -n "$d" ]] || continue
+#     if kubectl -n "$NS" get "deploy/${d}" >/dev/null 2>&1; then
+#       kubectl -n "$NS" rollout restart "deploy/${d}"
+#       kubectl -n "$NS" rollout status "deploy/${d}" --timeout=180s || true
+#     else
+#       echo "SKIP deploy/${d}（不存在）"
+#     fi
+#   done
+# fi
 if [[ "$RESTART_APIS" == "1" ]]; then
-  # 去重
-  readarray -t RESTART_SET < <(printf '%s\n' "${RESTART_SET[@]}" | sort -u)
-  echo "==> rollout restart: ${RESTART_SET[*]}"
-  for d in "${RESTART_SET[@]}"; do
-    [[ -n "$d" ]] || continue
-    if kubectl -n "$NS" get "deploy/${d}" >/dev/null 2>&1; then
-      kubectl -n "$NS" rollout restart "deploy/${d}"
-      kubectl -n "$NS" rollout status "deploy/${d}" --timeout=180s || true
-    else
-      echo "SKIP deploy/${d}（不存在）"
-    fi
-  done
+  echo "==> SKIP rollout restart（已暂时关闭；RESTART_APIS=1 被忽略）"
 fi

 echo "DONE"